In the transmit path of the bonding driver, skb->cb is used tostash the skb->queue_mapping so that the bonding device can set itsown queue mapping. This value becomes corrupted since the skb->cb isalso used in __dev_xmit_skb.

When transmitting through bonding driver, bond_select_queue iscalled from dev_queue_xmit. In bond_select_queue the originalskb->queue_mapping is copied into skb->cb (via bond_queue_mapping)and skb->queue_mapping is overwritten with the bond driver queue.

Subsequently in dev_queue_xmit, __dev_xmit_skb is called which writesthe packet length into skb->cb, thereby overwriting the stashedqueue mappping. In bond_dev_queue_xmit (called from hard_start_xmit),the queue mapping for the skb is set to the stashed value which is nowthe skb length and hence is an invalid queue for the slave device.

If we want to save skb->queue_mapping into skb->cb[], best place is toadd a field in struct qdisc_skb_cb, to make sure it wont conflict withother layers (eg : Qdiscc, Infiniband...)

This patchs also makes sure (struct qdisc_skb_cb)->data is aligned on 8bytes :

netem qdisc for example assumes it can store an u64 in it, withoutmisalignment penalty.

Note : we only have 20 bytes left in (struct qdisc_skb_cb)->data[].The largest user is CHOKe and it fills it.